Do we have any special design considerations for maintaining anonymity in an application?Don't forget, if you're showing aggregated numbers, it may be possible to identify people by comparing various totals and using a process of elimination. When working with healthcare data in the UK, totals less than five are not shown in order to reduce the risk of this. The necessity and level at which small numbers are suppressed depends on the number and sensitivity of the data.

Implementing new required feature after software releaseNull is the ideal value here, if the class is unknown then it should be null, not some other generic value. There is already data with unknown classes, so if you can't change that then leave the values as null and require new records to have a class value in the UI.

If the spec is flawed, should it still be followed?+1 for the paper trail, and also be careful if you are involved in the deployment. While it's unlikely to come to it, there are plenty of laws (the Data Protection Act in the UK for example) which mean negligent handling of personal data can become serious offence.